System and method for sdn orchestration validation

ABSTRACT

A system includes an orchestrator for a software-defined network and configured to receive a request for operation of the software-defined network, a software-defined network controller in communication with the orchestrator through a northbound application programming interface, at least one network element in communication with the software defined network controller though a southbound application programming interface, and a mutable network element configured to receive the request and instantiate a virtual function within the mutable network element to test the at least one network element in accordance with the request.

TECHNICAL FIELD

This disclosure is directed to a system and method for implementingsoftware-defined networks, and, more specifically, to utilizing avalidation process to protect against the introduction of malicious codeinto the network.

BACKGROUND

In Software Defined Networks (SDN), so called “northbound” and“southbound” application programming interfaces (APIs) could bemaliciously manipulated to command the virtual networking elements to beconfigured maliciously and/or to misinform the orchestrator about theactual configuration. For the purposes of this disclosure, a northboundAPIs will mean those APIs that are logically positioned between theorchestrator and a SDN controller and southbound APIs will mean thoseAPIs that are logically positioned between the SND controller andvirtual network elements. Based on manual input or automaticconfigurations based on business rules, orchestrators typically commandthe SDN controller, to implement network configurations on networkelements such as routers and switches. The APIs used to do so are oftenencrypted using transport layer security (“TLS”) making the contentsunreadable to entities other than the intended recipients. This createsa challenge to monitor the content of the APIs while in use.

There are several scenarios in which the lack of insight into thecontent of the APIs may present a risk to the integrity of the network.For example, the SDN controller may be compromised by hackers. This maymanifest itself by having the SDN controller manipulate the southboundAPIs by deliberately misinterpreting the commands from the orchestratorcoming through the northbound API. For example, the orchestrator maywant to block certain ports or protocols on the network element such asa router for security reason, but the compromised SDN controller maymaliciously not block those vulnerable ports or protocols.

A hacked SDN controller may also manipulate the northbound API bydeliberately misinterpreting the commands from the network elementcoming through the southbound API. For example, the network element suchas a router wants to report that a certain port is open, or protocol isallowed/disallowed, the compromised SDN controller may alter thisinformation, before it is passed to the orchestrator and theorchestrator may then will forward this misinformation to other networkelements which may cause security breaches or network failures or otherundesired scenarios.

In another unwanted scenario, a network element could be hacked toignore the information coming from the SDN controller through thesouthbound API and run its own malicious code. If the orchestrator iscompromised, it may ignore the business policies or needs and, using itsmalicious code, could send commands to the SDN controller through thenorthbound API creating unwanted or dangerous network configurations.

Thus, there is a need to create a system and method which will providean additional security check in a SDN to ensure that the businesspolicies are being implemented correctly and to uncover potentialfailures in the API's.

SUMMARY

The present disclosure is directed to a method including receiving arequest to instantiate a network element, instantiating the networkelement in accordance with the request, configuring a mutable networkelement to simulate at least one other network element based on thereceiving step, and receiving a confirmation that the network element isconfigured in accordance with the request. The method may furtherinclude commanding the mutable network element to test the networkelement prior to the network element becoming operational and togenerates the confirmation based on a result of the test. The method mayinclude wherein the test is an off-line operational test or a test basedon policies. The method may further include receiving an alert insteadof the confirmation if the test is a failed test. The method may furtherinclude enabling the network element to become operational.

The present disclosure is also direct to a system including anorchestrator for a software-defined network and configured to receive arequest for operation of the software-defined network, asoftware-defined network controller in communication with theorchestrator through a northbound application programming interface, atleast one network element in communication with the software definednetwork controller though a southbound application programminginterface, the network element configured to instantiate a networkelement virtual function based on the request, and a mutable networkelement configured to receive the request and instantiate one or moreadditional virtual functions within the mutable network element inaccordance with the request. In an aspect, the mutable network elementis configured to perform a test on the network element virtual functionin accordance with the request and wherein if the test is successful,the mutable network element is further configured to communicate theresults of the test to the orchestrator. In an aspect, the at least onenetwork element becomes operational in accordance with the request or ifthe test is not successful, the mutable network element is configured togenerate an alarm message.

The system may further include a policy database containing one or morepolicies and wherein the mutable network element is configured to testthe network element virtual function in accordance with the one or morepolicies or wherein the mutable network element is further configured tocommunicate with the at least one network element virtual function. Inan aspect, the mutable network element is configured to instantiate aplurality of replicated network element functions to mimic an operationof one or more network element functions. The mutable network elementmay be configured to perform a test of the virtual network elementfunction interacting with the plurality of replicated network functions.The test may include testing one of a permissible configuration or animpermissible configuration.

The present disclosure is further directed to an apparatus including aninput-output interface, a processor coupled to the input-outputinterface wherein the processor is further coupled to a memory thememory having stored thereon executable instructions that when executedby the processor cause the processor to effectuate operations includingreceiving a request to instantiate a network element, creating at leastone a virtual function to test the network element, testing a networkelement, and permitting the network element to become active based onthe testing. The testing step may be based on one of the request or apolicy and if the testing step is not successful, the operations mayfurther include generating an alarm instead of performing the permittingstep. The operations may further include deleting the virtual functionafter the permitting step is executed.

BRIEF DESCRIPTION OF THE DRAWINGS

Aspects of the herein described telecommunications network and systemsand methods are described more fully with reference to the accompanyingdrawings, which provide examples. In the following description, forpurposes of explanation, numerous specific details are set forth inorder to provide an understanding of the variations in implementing thedisclosed technology. However, the instant disclosure may take manydifferent forms and should not be construed as limited to the examplesset forth herein. Where practical, like numbers refer to like elementsthroughout.

FIG. 1a is a representation of an exemplary network.

FIG. 1b is a representation of an exemplary hardware platform for anetwork.

FIG. 2a is a representation of an exemplary generic network constructedin accordance with the present disclosure.

FIG. 2b is an exemplary representation of the functionality of a mutablenetwork element constructed in accordance with the present disclosure.

FIG. 3 is an exemplary method of operation in accordance with thepresent disclosure.

FIG. 4 depicts an exemplary communication system that provide wirelesstelecommunication services over wireless communication networks that maybe at least partially implemented as an SDN.

FIG. 5 depicts an exemplary diagrammatic representation of a machine inthe form of a computer system.

FIG. 6 is an exemplary diagrammatic representation of a cellularcommunications network.

FIG. 7 is an example system including RAN and core network functions.

FIG. 8 depicts an overall block diagram of an example packet-basedmobile cellular network environment.

FIG. 9 illustrates an architecture of a typical GPRS network

FIG. 10 illustrates a PLMN block diagram view of an example architecturethat may be replaced by a telecommunications system

DETAILED DESCRIPTION

System Overview. The present disclosure includes a new and novel mutablenetwork element (MNE), a separate dedicated network element that readsthe business request and becomes a node with appropriate identifiers tocommunicate with the recently configured or modified network element toverify the business input is properly implemented prior to the networkelement going online. The system and method disclosed herein are apractical application of telecommunications technology and advance thestate of the art in that telecommunications technology.

The MNE may be a generic network element that can function, for example,as a server or router with a configurable structure. An MNE may connectto all network elements to verify the business request has beencorrectly implemented. Once verified, the MNE will then allow thetraffic flow from orchestrator back to the higher layer and permit theimplementation of the desired configuration for the newly configured ormodified network element.

The MNE may assume the identify of any network element. For example, thebusiness input may request that the orchestrator configure a new networkelement NE X1 to allow connectivity to server having an external IPaddress 135.122.10.14 on a specified port using a specified protocolcoming from the Internet and that the port should be set to 10 Gbps. Theorchestrator will communicate this to the SDN controller via thenorthbound API which in turn will communicated this to the networkelement NE XI through the southbound API. Network element NE X1 willthen implement the configuration. Before going live, the MNE will assumethe personality of the server with IP address: 135.122.10.14 and willattempt to communicate with this newly configured network element NE X1using the specified protocols with the specified port and with thespecified bandwidth of 10 Gbps from the Internet to make sure the exactconfiguration that was requested has in fact been implemented.

In an aspect, the MNE may also host a database for security policies,for example, policies that prohibit certain configurations for a networkelement. The MNE may also attempt to communicate with the newlyconfigured network element NE X1 via prohibited protocols, ports, and/orspeeds and using nonwhite-listed IP addresses. These communicationattempts should fail to ensure that nothing prohibited has beenimplemented. Thus, the MNE may perform a two-stage verification toensure the configuration as requested is implemented and alternativeconfigurations not requested are not implemented.

After the verification process is complete, the orchestrator may thenreport back to higher layers that newly requested configuration has beenimplemented and the newly configured network element is now active.

The MNE may be activated every time the orchestrator receives a request.If the MNE reports a discrepancy or detects a disallowed configuration,the system may generate an alert and may further isolate the systemuntil it is checked and cleared for operation.

Operating Environment. FIG. 1a is a representation of an exemplarynetwork 100. Network 100 may comprise an SDN—that is, network 100 mayinclude one or more virtualized functions implemented on general purposehardware, such as in lieu of having dedicated hardware for every networkfunction. That is, general purpose hardware of network 100 may beconfigured to run virtual network elements to support communicationservices, such as mobility services, including consumer services andenterprise services. These services may be provided or measured insessions.

A virtual network functions (VNFs) 102 may be able to support a limitednumber of sessions. Each VNF 102 may have a VNF type that indicates itsfunctionality or role. For example, FIG. 1a illustrates a gateway VNF102 a and a policy and charging rules function (PCRF) VNF 102 b.Additionally or alternatively, VNFs 102 may include other types of VNFs.Each VNF 102 may use one or more virtual machines (VMs) 104 to operate.Each VM 104 may have a VM type that indicates its functionality or role.For example, FIG. 1a illustrates a MCM VM 104 a, an ASM VM 104 b, and aDEP VM 104 c. Additionally or alternatively, VMs 104 may include othertypes of VMs. Each VM 104 may consume various network resources from ahardware platform 106, such as a resource 108, a virtual centralprocessing unit (vCPU) 108 a, memory 108 b, or a network interface card(NIC) 108 c. Additionally or alternatively, hardware platform 106 mayinclude other types of resources 108.

While FIG. 1a illustrates resources 108 as collectively contained inhardware platform 106, the configuration of hardware platform 106 mayisolate, for example, certain memory 108 c from other memory 108 c. FIG.1b provides an exemplary implementation of hardware platform 106 whichwill be discussed in more detail below.

FIG. 2a shows an exemplary generic network configuration 10 of asoftware defined network having an orchestrator 22. An orchestrator isgenerally known in the art and may include the process of automaticallyprogramming the behavior of a network in accordance with a set of rules,policies and business requirements, so that the network smoothlycoordinates with the hardware and the software elements to furthersupport applications and services, in this case in a software-definednetwork. The orchestrator 22 may operate based on input businessrequests or policies, represented by input arrow 20, associated with thebusiness operations, network operations, security, quality of service,or any of a plurality of needs of the business.

There is also shown an SDN controller 26 and networking elements 30. TheSDN controller 26 may direct traffic according to policies that anetwork operator puts in place to automatically configure individualnetwork devices. In a software defined network, the SDN controller 26may facilitate automated network management and enable the integrationand administration of network and business applications.

There may be one or more APIs. For example, there may be one or more anorthbound APIs 24 between the orchestrator 22 and the SDN controller 26and one or more southbound APIs between the SDN controller 26 andnetworking elements 30. The SDN controller communicates withapplications—such as firewalls or load balancers—through theorchestrator via northbound interfaces. The SDN controller talks withindividual network elements 30 using a southbound interface which may,for example, use the OpenFlow protocol. These southbound protocols allowthe controller to configure network elements 30 and choose the optimalnetwork path for application traffic.

The network elements 30 may include VM functions which may, for example,include the establishment of virtual machines implementing a variety ofprocessing, memory or connectivity applications, including softwareimplementation of a variety of network elements, such as gateways, RANinterface support, routers, switches, and other network elements, someof which are described in more detail below.

Also shown is a new and novel element we named the mutable networkelement (MNE) 32. The MNE 32 may be a generic network element that canfunction as a server or router with a configurable structure. The MNE 32may be a separate dedicated virtual network element that reads thebusiness request 20 and in response thereto, becomes a temporary node inthe network with appropriate identifiers. The MNE 32 may thencommunicate with the recently instantiated or modified networkingelement 30 to verify that business request 20 has been properlyimplemented.

The MNE 32 may connect to any or all network elements 30 or assume theidentify of one or more network elements 30 to verify the configuration.Once the configuration is verified, the MNE 32 will inform theorchestrator 22 which may then report back to the higher layer(s) forimplementation of the requested configuration. The MNE 32 may assume theidentity of any network element 30. As such, the MNE 32 presents a softquarantine for any newly updated business requests 20 input into theorchestrator 22.

A sample MNE 32 is shown in FIG. 2b . There is shown an upstreaminterface 25 for communicating with the orchestrator 22 and to accessthe business rules 20. There is also shown a network element interface27 which permits interaction with the networking elements 30. There isalso shown a policy database 29 that may host a database for securitypolicies. Such security policies may, for example, included permittedand prohibited configurations with each type and instance of a networkelement. The policies may also include permitted and prohibitedprotocols, ports, and speeds associated with the network elements. Theremay also be white-listed and nonwhite-listed IP addresses. Such policiesmay be pre-defined by an administrator on a per network element basis.

Also shown is a mini orchestrator 23. The mini orchestrator mayconfigure the MNE 32 or other MNEs as off-line instantiations of thesurrounding network elements. For example, a newly configured router maybe instructed to communicate with two servers that may already exist inthe network. The mini orchestrator may configure and instantiate copiesof the two servers and then verify the communications between the newlyconfigured router and the two servers is proper and consistent with thepolicies. The mini orchestrator may also configure and instantiate athird server which is not part of the network and then verify that thenewly configured router is prohibited from communicating with the thirdserver.

Operations. With reference to FIG. 3, there is shown an exemplary flowchart describing a method in accordance with the present disclosure. At34, the orchestrator 22 receives a request from the business through thebusiness request input 20. The request may, for example, be for theinstantiation of a newly configured SDN network element such as arouter, gateway or other network element. At 35, a mutable networkelement 32 is activated and a network element 30 is configured inaccordance with the business request. At 36, the mutable network element32 is configured to operate as if it is any network element currentlyoperational in order to test the network element 30 instantiated by theorchestrator 22 based on the business request.

However, the newly configured network element 30 may remain isolatedfrom the operational network until the network element 30 configurationis verified. At 37, the first step of that verification is completed indetermining whether the network element 30 is operating correctly inview of the mutable network element 32 mimicking other relevant portionsof the network to test the network element. This may include the testingof the network element 30 to ensure that the ports, speeds, andinterconnections have been set up correctly. If the network element 30is not operating correctly, then an alert to the system or systemoperator is generated at 39. If the network element 30 is operatingcorrectly at 37, a second verification step may be performed at 38 todetermine whether the security policies are implemented correctly. Thesecurity policies may test for negative situations, for example, thecase in which a port is closed for security reasons may in fact be open,thereby increasing the risk of a security breach. If the securitypolicies are not implemented correctly, then the alert to the system orsystem operator is generated at 39. If the security policies areimplemented correctly, the newly configured network element 30 ispermitted to go on-line and operational in the network and thesuccessful instantiation is sent back to the orchestrator 22 for furtherreporting up the business chain.

The verification steps at 37 and 38 are described above and including anexample in the section labeled “System Overview”. The alerts generatedat 39 may include a warning that the orchestrator is not functioningproperly or that the northbound APIs or southbound APIs are corrupted.

The system and methods of the present disclosure provide a practicalapplication that advances the state of the telecommunicationstechnology. The system and method provide a soft quarantine of newlyconfigured network elements 30 to reduce the risk that the network isexposed to potential security breaches. In view of the nature of themutable network elements, it is possible to scale the configuration ofsoftware defined networks based on the business requests quickly andefficiently while at the same time reducing the risk of a securitybreach and thereby increase speed and reliability. The system and methodpermit orchestration validation within the network stream and at thesame time temporarily extracting orchestration validation to the MNEs.

Device and Network Description. The characteristics of each chassis 110and each server 112 may differ. For example, FIG. 1b illustrates thatthe number of servers 112 within two chasses 110 may vary. Additionally,or alternatively, the type or number of resources 110 within each server112 may vary. In an aspect, chassis 110 may be used to group servers 112with the same resource characteristics. In another aspect, servers 112within the same chassis 110 may have different resource characteristics.

Given hardware platform 106, the number of sessions that may beinstantiated may vary depending upon how efficiently resources 108 areassigned to different VMs 104. For example, assignment of VMs 104 toparticular resources 108 may be constrained by one or more rules. Forexample, a first rule may require that resources 108 assigned to aparticular VM 104 be on the same server 112 or set of servers 112. Forexample, if VM 104 uses eight vCPUs 108 a, 1 GB of memory 108 b, and 2NICs 108 c, the rules may require that all these resources 108 besourced from the same server 112. Additionally, or alternatively, VM 104may require splitting resources 108 among multiple servers 112, but suchsplitting may need to conform with certain restrictions. For example,resources 108 for VM 104 may be able to be split between two servers112. Default rules may apply. For example, a default rule may requirethat all resources 108 for a given VM 104 must come from the same server112.

An affinity rule may restrict assignment of resources 108 for aparticular VM 104 (or a particular type of VM 104). For example, anaffinity rule may require that certain VMs 104 be instantiated on (thatis, consume resources from) the same server 112 or chassis 110. Forexample, if VNF 102 uses six MCM VMs 104 a, an affinity rule may dictatethat those six MCM VMs 104 a be instantiated on the same server 112 (orchassis 110). As another example, if VNF 102 uses MCM VMs 104 a, ASM VMs104 b, and a third type of VMs 104, an affinity rule may dictate that atleast the MCM VMs 104 a and the ASM VMs 104 b be instantiated on thesame server 112 (or chassis 110). Affinity rules may restrict assignmentof resources 108 based on the identity or type of resource 108, VNF 102,VM 104, chassis 110, server 112, or any combination thereof.

An anti-affinity rule may restrict assignment of resources 108 for aparticular VM 104 (or a particular type of VM 104). In contrast to anaffinity rule—which may require that certain VMs 104 be instantiated onthe same server 112 or chassis 110—an anti-affinity rule requires thatcertain VMs 104 be instantiated on different servers 112 (or differentchasses 110). For example, an anti-affinity rule may require that MCM VM104 a be instantiated on a particular server 112 that does not containany ASM VMs 104 b. As another example, an anti-affinity rule may requirethat MCM VMs 104 a for a first VNF 102 be instantiated on a differentserver 112 (or chassis 110) than MCM VMs 104 a for a second VNF 102.Anti-affinity rules may restrict assignment of resources 108 based onthe identity or type of resource 108, VNF 102, VM 104, chassis 110,server 112, or any combination thereof.

Within these constraints, resources 108 of hardware platform 106 may beassigned to be used to instantiate VMs 104, which in turn may be used toinstantiate VNFs 102, which in turn may be used to establish sessions.The different combinations for how such resources 108 may be assignedmay vary in complexity and efficiency. For example, differentassignments may have different limits of the number of sessions that canbe established given a particular hardware platform 106.

For example, consider a session that may require gateway VNF 102 a andPCRF VNF 102 b. Gateway VNF 102 a may require five VMs 104 instantiatedon the same server 112, and PCRF VNF 102 b may require two VMs 104instantiated on the same server 112. (Assume, for this example, that noaffinity or anti-affinity rules restrict whether VMs 104 for PCRF VNF102 b may or must be instantiated on the same or different server 112than VMs 104 for gateway VNF 102 a.) In this example, each of twoservers 112 may have sufficient resources 108 to support 10 VMs 104. Toimplement sessions using these two servers 112, first server 112 may beinstantiated with 10 VMs 104 to support two instantiations of gatewayVNF 102 a, and second server 112 may be instantiated with 9 VMs: fiveVMs 104 to support one instantiation of gateway VNF 102 a and four VMs104 to support two instantiations of PCRF VNF 102 b.This may leave theremaining resources 108 that could have supported the tenth VM 104 onsecond server 112 unused (and unusable for an instantiation of either agateway VNF 102 a or a PCRF VNF 102 b). Alternatively, first server 112may be instantiated with 10 VMs 104 for two instantiations of gatewayVNF 102 a and second server 112 may be instantiated with 10 VMs 104 forfive instantiations of PCRF VNF 102 b, using all available resources 108to maximize the number of VMs 104 instantiated.

Consider, further, how many sessions each gateway VNF 102 a and eachPCRF VNF 102 b may support. This may factor into which assignment ofresources 108 is more efficient. For example, consider if each gatewayVNF 102 a supports two million sessions, and if each PCRF VNF 102 bsupports three million sessions. For the first configuration—three totalgateway VNFs 102 a (which satisfy the gateway requirement for sixmillion sessions) and two total PCRF VNFs 102 b (which satisfy the PCRFrequirement for six million sessions)—would support a total of sixmillion sessions. For the second configuration—two total gateway VNFs102 a (which satisfy the gateway requirement for four million sessions)and five total PCRF VNFs 102 b (which satisfy the PCRF requirement for15 million sessions)—would support a total of four million sessions.Thus, while the first configuration may seem less efficient looking onlyat the number of available resources 108 used (as resources 108 for thetenth possible VM 104 are unused), the second configuration is moreefficient from the perspective of being the configuration that cansupport more the greater number of sessions.

To solve the problem of determining a capacity (or, number of sessions)that can be supported by a given hardware platform 105, a givenrequirement for VNFs 102 to support a session, a capacity for the numberof sessions each VNF 102 (e.g., of a certain type) can support, a givenrequirement for VMs 104 for each VNF 102 (e.g., of a certain type), agive requirement for resources 108 to support each VM 104 (e.g., of acertain type), rules dictating the assignment of resources 108 to one ormore VMs 104 (e.g., affinity and anti-affinity rules), the chasses 110and servers 112 of hardware platform 106, and the individual resources108 of each chassis 110 or server 112 (e.g., of a certain type), aninteger programming problem may be formulated.

First, a plurality of index sets may be established. For example, indexset L may include the set of chasses 110. For example, if a systemallows up to 6 chasses 110, this set may be:

L={1, 2, 3, 4, 5, 6}, where l is an element of L.

Another index set J may include the set of servers 112. For example, ifa system allows up to 16 servers 112 per chassis 110, this set may be:

J={1, 2, 3, . . . , 16}, where j is an element of J.

As another example, index set K having at least one element k mayinclude the set of VNFs 102 that may be considered. For example, thisindex set may include all types of VNFs 102 that may be used toinstantiate a service. For example, let K={GW, PCRF} where GW representsgateway VNFs 102 a and PCRF represents PCRF VNFs 102 b.

Another index set I(k) may equal the set of VMs 104 for a VNF 102 k .Thus, let I(GW)={MCM, ASM, IOM, WSM, CCM, DCM} represent VMs 104 forgateway VNF 102 a, where MCM represents MCM VM 104 a, ASM represents ASMVM 104 b, and each of IOM, WSM, CCM, and DCM represents a respectivetype of VM 104. Further, let

I(PCRF)={DEP, DIR, POL, SES, MAN} represent VMs 104 for PCRF VNF 102 b,where DEP represents DEP VM 104 c and each of DIR, POL, SES, and MANrepresent a respective type of VM 104.

Another index set V may include the set of possible instances of a givenVM 104. For example, if a system allows up to 20 instances of VMs 102,this set may be: V={1, 2, 3, . . . , 20}, where v is an element of V.

In addition to the sets, the integer programming problem may includeadditional data. The characteristics of VNFs 102, VMs 104, chasses 110,or servers 112 may be factored into the problem. This data may bereferred to as parameters. For example, for given VNF 102 k , the numberof sessions that VNF 102 k can support may be defined as a functionS(k). In an aspect, for an element k of set K, this parameter may berepresented by S(k)>=0; is a measurement of the number of sessions k cansupport. Returning to the earlier example where gateway VNF 102 a maysupport 2 million sessions, then this parameter may be S(GW)=2,000,000.

VM 104 modularity may be another parameter in the integer programmingproblem. VM 104 modularity may represent the VM 104 requirement for atype of VNF 102. For example, fork that is an element of set K and ithat is an element of set I, each instance of VNF k may require M(k, i)instances of VMs 104. For example, recall the example where I(GW)={MCM,ASM, IOM, WSM, CCM, DCM}.

In an example, M(GW, I(GW)) may be the set that indicates the number ofeach type of VM 104 that may be required to instantiate gateway VNF 102a. For example, M(GW, I(GW))={2, 16, 4, 4, 2, 4} may indicate that oneinstantiation of gateway VNF 102 a may require two instantiations of MCMVMs 104 a, 16 instantiations of ACM VM 104 b, four instantiations of IOMVM 104, four instantiations of WSM VM 104, two instantiations of CCM VM104, and four instantiations of DCM VM 104.

Another parameter may indicate the capacity of hardware platform 106.For example, a parameter C may indicate the number of vCPUs 108 arequired for each VM 104 type i and for each VNF 102 type k. Forexample, this may include the parameter C(k, i). For example, if MCM VM104 a for gateway VNF 102 a requires 20 vCPUs 108 a, this may berepresented as C(GW, MCM)=20.

However, given the complexity of the integer programming problem—thenumerous variables and restrictions that must be satisfied—implementingan algorithm that may be used to solve the integer programming problemefficiently, without sacrificing optimality, may be difficult.

FIG. 4 illustrates a functional block diagram depicting one example ofan LTE-EPS network architecture 400 that may be at least partiallyimplemented as an SDN. Network architecture 400 disclosed herein isreferred to as a modified LTE-EPS architecture 400 to distinguish itfrom a traditional LTE-EPS architecture.

An example modified LTE-EPS architecture 400 is based at least in parton standards developed by the 3rd Generation Partnership Project (3GPP),with information available at www.3gpp.org. LTE-EPS network architecture400 may include an access network 402, a core network 404, e.g., an EPCor Common BackBone (CBB) and one or more external networks 406,sometimes referred to as PDN or peer entities. Different externalnetworks 406 can be distinguished from each other by a respectivenetwork identifier, e.g., a label according to DNS naming conventionsdescribing an access point to the PDN. Such labels can be referred to asAccess Point Names (APN). External networks 406 can include one or moretrusted and non-trusted external networks such as an internet protocol(IP) network 408, an IP multimedia subsystem (IMS) network 410, andother networks 412, such as a service network, a corporate network, orthe like. In an aspect, access network 402, core network 404, orexternal network 405 may include or communicate with network 100.

Access network 402 can include an LTE network architecture sometimesreferred to as Evolved Universal mobile Telecommunication systemTerrestrial Radio Access (E UTRA) and evolved UMTS Terrestrial RadioAccess Network (E-UTRAN). Broadly, access network 402 can include one ormore communication devices, commonly referred to as UE 414, and one ormore wireless access nodes, or base stations 416 a, 416 b. Duringnetwork operations, at least one base station 416 communicates directlywith UE 414. Base station 416 can be an evolved Node B (e-NodeB), withwhich UE 414 communicates over the air and wirelessly. UEs 414 caninclude, without limitation, wireless devices, e.g., satellitecommunication systems, portable digital assistants (PDAs), laptopcomputers, tablet devices and other mobile devices (e.g., cellulartelephones, smart appliances, and so on). UEs 414 can connect to eNBs416 when UE 414 is within range according to a corresponding wirelesscommunication technology.

UE 414 generally runs one or more applications that engage in a transferof packets between UE 414 and one or more external networks 406. Suchpacket transfers can include one of downlink packet transfers fromexternal network 406 to UE 414, uplink packet transfers from UE 414 toexternal network 406 or combinations of uplink and downlink packettransfers. Applications can include, without limitation, web browsing,VoIP, streaming media and the like. Each application can pose differentQuality of Service (QoS) requirements on a respective packet transfer.Different packet transfers can be served by different bearers withincore network 404, e.g., according to parameters, such as the QoS.

Core network 404 uses a concept of bearers, e.g., EPS bearers, to routepackets, e.g., IP traffic, between a particular gateway in core network404 and UE 414. A bearer refers generally to an IP packet flow with adefined QoS between the particular gateway and UE 414. Access network402, e.g., E UTRAN, and core network 404 together set up and releasebearers as required by the various applications. Bearers can beclassified in at least two different categories: (i) minimum guaranteedbit rate bearers, e.g., for applications, such as VoIP; and (ii)non-guaranteed bit rate bearers that do not require guarantee bit rate,e.g., for applications, such as web browsing.

In one embodiment, the core network 404 includes various networkentities, such as MME 418, SGW 420, Home Subscriber Server (HSS) 422,Policy and Charging Rules Function (PCRF) 424 and PGW 426. In oneembodiment, MME 418 comprises a control node performing a controlsignaling between various equipment and devices in access network 402and core network 404. The protocols running between UE 414 and corenetwork 404 are generally known as Non-Access Stratum (NAS) protocols.

For illustration purposes only, the terms MME 418, SGW 420, HSS 422 andPGW 426, and so on, can be server devices, but may be referred to in thesubject disclosure without the word “server.” It is also understood thatany form of such servers can operate in a device, system, component, orother form of centralized or distributed hardware and software. It isfurther noted that these terms and other terms such as bearer pathsand/or interfaces are terms that can include features, methodologies,and/or fields that may be described in whole or in part by standardsbodies such as the 3GPP. It is further noted that some or allembodiments of the subject disclosure may in whole or in part modify,supplement, or otherwise supersede final or proposed standards publishedand promulgated by 3GPP.

According to traditional implementations of LTE-EPS architectures, SGW420 routes and forwards all user data packets. SGW 420 also acts as amobility anchor for user plane operation during handovers between basestations, e.g., during a handover from first eNB 416 a to second eNB 416b as may be the result of UE 414 moving from one area of coverage, e.g.,cell, to another. SGW 420 can also terminate a downlink data path, e.g.,from external network 406 to UE 414 in an idle state and trigger apaging operation when downlink data arrives for UE 414. SGW 420 can alsobe configured to manage and store a context for UE 414, e.g., includingone or more of parameters of the IP bearer service and network internalrouting information. In addition, SGW 420 can perform administrativefunctions, e.g., in a visited network, such as collecting informationfor charging (e.g., the volume of data sent to or received from theuser), and/or replicate user traffic, e.g., to support a lawfulinterception. SGW 420 also serves as the mobility anchor forinterworking with other 3GPP technologies such as universal mobiletelecommunication system (UMTS).

At any given time, UE 414 is generally in one of three different states:detached, idle, or active. The detached state is typically a transitorystate in which UE 414 is powered on but is engaged in a process ofsearching and registering with network 402. In the active state, UE 414is registered with access network 402 and has established a wirelessconnection, e.g., radio resource control (RRC) connection, with eNB 416.Whether UE 414 is in an active state can depend on the state of a packetdata session, and whether there is an active packet data session. In theidle state, UE 414 is generally in a power conservation state in whichUE 414 typically does not communicate packets. When UE 414 is idle, SGW420 can terminate a downlink data path, e.g., from one peer entity 406,and triggers paging of UE 414 when data arrives for UE 414. If UE 414responds to the page, SGW 420 can forward the IP packet to eNB 416 a.

HSS 422 can manage subscription-related information for a user of UE414. For example, tHSS 422 can store information such as authorizationof the user, security requirements for the user, quality of service(QoS) requirements for the user, etc. HSS 422 can also hold informationabout external networks 406 to which the user can connect, e.g., in theform of an APN of external networks 406. For example, MME 418 cancommunicate with HSS 422 to determine if UE 414 is authorized toestablish a call, e.g., a voice over IP (VoIP) call before the call isestablished.

PCRF 424 can perform QoS management functions and policy control. PCRF424 is responsible for policy control decision-making, as well as forcontrolling the flow-based charging functionalities in a policy controlenforcement function (PCEF), which resides in PGW 426. PCRF 424 providesthe QoS authorization, e.g., QoS class identifier and bit rates thatdecide how a certain data flow will be treated in the PCEF and ensuresthat this is in accordance with the user's subscription profile.

PGW 426 can provide connectivity between the UE 414 and one or more ofthe external networks 406. In illustrative network architecture 400, PGW426 can be responsible for IP address allocation for UE 414, as well asone or more of QoS enforcement and flow-based charging, e.g., accordingto rules from the PCRF 424. PGW 426 is also typically responsible forfiltering downlink user IP packets into the different QoS-based bearers.In at least some embodiments, such filtering can be performed based ontraffic flow templates. PGW 426 can also perform QoS enforcement, e.g.,for guaranteed bit rate bearers. PGW 426 also serves as a mobilityanchor for interworking with non-3GPP technologies such as CDMA2000.

Within access network 402 and core network 404 there may be variousbearer paths/interfaces, e.g., represented by solid lines 428 and 430.Some of the bearer paths can be referred to by a specific label. Forexample, solid line 428 can be considered an S1-U bearer and solid line432 can be considered an S5/S8 bearer according to LTE-EPS architecturestandards. Without limitation, reference to various interfaces, such asS1, X2, S5, S8, S11 refer to EPS interfaces. In some instances, suchinterface designations are combined with a suffix, e.g., a “U” or a “C”to signify whether the interface relates to a “User plane” or a “Controlplane.” In addition, the core network 404 can include various signalingbearer paths/interfaces, e.g., control plane paths/interfacesrepresented by dashed lines 430, 434, 436, and 438. Some of thesignaling bearer paths may be referred to by a specific label. Forexample, dashed line 430 can be considered as an S1-MME signalingbearer, dashed line 434 can be considered as an S11 signaling bearer anddashed line 436 can be considered as an S6a signaling bearer, e.g.,according to LTE-EPS architecture standards. The above bearer paths andsignaling bearer paths are only illustrated as examples and it should benoted that additional bearer paths and signaling bearer paths may existthat are not illustrated.

Also shown is a novel user plane path/interface, referred to as theS1-U+ interface 466. In the illustrative example, the S1-U+ user planeinterface extends between the eNB 416 a and PGW 426. Notably, S1-U+path/interface does not include SGW 420, a node that is otherwiseinstrumental in configuring and/or managing packet forwarding betweeneNB 416 a and one or more external networks 406 by way of PGW 426. Asdisclosed herein, the S1-U+ path/interface facilitates autonomouslearning of peer transport layer addresses by one or more of the networknodes to facilitate a self-configuring of the packet forwarding path. Inparticular, such self-configuring can be accomplished during handoversin most scenarios so as to reduce any extra signaling load on the S/PGWs420, 426 due to excessive handover events.

In some embodiments, PGW 426 is coupled to storage device 440, shown inphantom. Storage device 440 can be integral to one of the network nodes,such as PGW 426, for example, in the form of internal memory and/or diskdrive. It is understood that storage device 440 can include registerssuitable for storing address values. Alternatively, or in addition,storage device 440 can be separate from PGW 426, for example, as anexternal hard drive, a flash drive, and/or network storage.

Storage device 440 selectively stores one or more values relevant to theforwarding of packet data. For example, storage device 440 can storeidentities and/or addresses of network entities, such as any of networknodes 418, 420, 422, 424, and 426, eNBs 416 and/or UE 414. In theillustrative example, storage device 440 includes a first storagelocation 442 and a second storage location 444. First storage location442 can be dedicated to storing a Currently Used Downlink address value442. Likewise, second storage location 444 can be dedicated to storing aDefault Downlink Forwarding address value 444. PGW 426 can read and/orwrite values into either of storage locations 442, 444, for example,managing Currently Used Downlink Forwarding address value 442 andDefault Downlink Forwarding address value 444 as disclosed herein.

In some embodiments, the Default Downlink Forwarding address for eachEPS bearer is the SGW S5-U address for each EPS Bearer. The CurrentlyUsed Downlink Forwarding address” for each EPS bearer in PGW 426 can beset every time when PGW 426 receives an uplink packet, e.g., a GTP-Uuplink packet, with a new source address for a corresponding EPS bearer.When UE 414 is in an idle state, the “Current Used Downlink Forwardingaddress” field for each EPS bearer of UE 414 can be set to a “null” orother suitable value.

In some embodiments, the Default Downlink Forwarding address is onlyupdated when PGW 426 receives a new SGW S5-U address in a predeterminedmessage or messages. For example, the Default Downlink Forwardingaddress is only updated when PGW 426 receives one of a Create SessionRequest, Modify Bearer Request and Create Bearer Response messages fromSGW 420.

As values 442, 444 can be maintained and otherwise manipulated on a perbearer basis, it is understood that the storage locations can take theform of tables, spreadsheets, lists, and/or other data structuresgenerally well understood and suitable for maintaining and/or otherwisemanipulate forwarding addresses on a per bearer basis.

It should be noted that access network 402 and core network 404 areillustrated in a simplified block diagram in FIG. 4. In other words,either or both of access network 402 and the core network 404 caninclude additional network elements that are not shown, such as variousrouters, switches and controllers. In addition, although FIG. 4illustrates only a single one of each of the various network elements,it should be noted that access network 402 and core network 404 caninclude any number of the various network elements. For example, corenetwork 404 can include a pool (i.e., more than one) of MMEs 418, SGWs420 or PGWs 426.

In the illustrative example, data traversing a network path between UE414, eNB 416 a, SGW 420, PGW 426 and external network 406 may beconsidered to constitute data transferred according to an end-to-end IPservice. However, for the present disclosure, to properly performestablishment management in LTE-EPS network architecture 400, the corenetwork, data bearer portion of the end-to-end IP service is analyzed.

An establishment may be defined herein as a connection set up requestbetween any two elements within LTE-EPS network architecture 400. Theconnection set up request may be for user data or for signaling. Afailed establishment may be defined as a connection set up request thatwas unsuccessful. A successful establishment may be defined as aconnection set up request that was successful.

In one embodiment, a data bearer portion comprises a first portion(e.g., a data radio bearer 446) between UE 414 and eNB 416 a, a secondportion (e.g., an S1 data bearer 428) between eNB 416 a and SGW 420, anda third portion (e.g., an S5/S8 bearer 432) between SGW 420 and PGW 426.Various signaling bearer portions are also illustrated in FIG. 4. Forexample, a first signaling portion (e.g., a signaling radio bearer 448)between UE 414 and eNB 416 a, and a second signaling portion (e.g., S1signaling bearer 430) between eNB 416 a and MME 418.

In at least some embodiments, the data bearer can include tunneling,e.g., IP tunneling, by which data packets can be forwarded in anencapsulated manner, between tunnel endpoints. Tunnels, or tunnelconnections can be identified in one or more nodes of network 100, e.g.,by one or more of tunnel endpoint identifiers, an IP address and a userdatagram protocol port number. Within a particular tunnel connection,payloads, e.g., packet data, which may or may not include protocolrelated information, are forwarded between tunnel endpoints.

An example of first tunnel solution 450 includes a first tunnel 452 abetween two tunnel endpoints 454 a and 456 a, and a second tunnel 452 bbetween two tunnel endpoints 454 b and 456 b. In the illustrativeexample, first tunnel 452 a is established between eNB 416 a and SGW420. Accordingly, first tunnel 452 a includes a first tunnel endpoint454 a corresponding to an S1-U address of eNB 416 a (referred to hereinas the eNB S1-U address), and second tunnel endpoint 456 a correspondingto an S1-U address of SGW 420 (referred to herein as the SGW S1-Uaddress). Likewise, second tunnel 452 b includes first tunnel endpoint454 b corresponding to an S5-U address of SGW 420 (referred to herein asthe SGW S5-U address), and second tunnel endpoint 456 b corresponding toan S5-U address of PGW 426 (referred to herein as the PGW S5-U address).

In at least some embodiments, first tunnel solution 450 is referred toas a two-tunnel solution, e.g., according to the GPRS Tunneling ProtocolUser Plane (GTPv1-U based), as described in 3GPP specification TS29.281, incorporated herein in its entirety. It is understood that oneor more tunnels are permitted between each set of tunnel end points. Forexample, each subscriber can have one or more tunnels, e.g., one foreach PDP context that they have active, as well as possibly havingseparate tunnels for specific connections with different quality ofservice requirements, and so on.

An example of second tunnel solution 458 includes a single or directtunnel 460 between tunnel endpoints 462 and 464. In the illustrativeexample, direct tunnel 460 is established between eNB 416 a and PGW 426,without subjecting packet transfers to processing related to SGW 420.Accordingly, direct tunnel 460 includes first tunnel endpoint 462corresponding to the eNB S1-U address, and second tunnel endpoint 464corresponding to the PGW S5-U address. Packet data received at eitherend can be encapsulated into a payload and directed to the correspondingaddress of the other end of the tunnel. Such direct tunneling avoidsprocessing, e.g., by SGW 420 that would otherwise relay packets betweenthe same two endpoints, e.g., according to a protocol, such as the GTP-Uprotocol.

In some scenarios, direct tunneling solution 458 can forward user planedata packets between eNB 416 a and PGW 426, by way of SGW 420. That is,SGW 420 can serve a relay function, by relaying packets between twotunnel endpoints 416 a, 426. In other scenarios, direct tunnelingsolution 458 can forward user data packets between eNB 416 a and PGW426, by way of the S1 U+ interface, thereby bypassing SGW 420.

Generally, UE 414 can have one or more bearers at any one time. Thenumber and types of bearers can depend on applications, defaultrequirements, and so on. It is understood that the techniques disclosedherein, including the configuration, management and use of varioustunnel solutions 450, 458, can be applied to the bearers on anindividual basis. That is, if user data packets of one bearer, say abearer associated with a VoIP service of UE 414, then the forwarding ofall packets of that bearer are handled in a similar manner. Continuingwith this example, the same UE 414 can have another bearer associatedwith it through the same eNB 416 a. This other bearer, for example, canbe associated with a relatively low rate data session forwarding userdata packets through core network 404 simultaneously with the firstbearer. Likewise, the user data packets of the other bearer are alsohandled in a similar manner, without necessarily following a forwardingpath or solution of the first bearer. Thus, one of the bearers may beforwarded through direct tunnel 458; whereas, another one of the bearersmay be forwarded through a two-tunnel solution 450.

FIG. 5 depicts an exemplary diagrammatic representation of a machine inthe form of a computer system 500 within which a set of instructions,when executed, may cause the machine to perform any one or more of themethods described above. One or more instances of the machine canoperate, for example, as processor 302, UE 414, eNB 416, MME 418, SGW420, HSS 422, PCRF 424, PGW 426 and other devices of FIGS. 1, 2, and 4.In some embodiments, the machine may be connected (e.g., using a network502) to other machines. In a networked deployment, the machine mayoperate in the capacity of a server or a client user machine in aserver-client user network environment, or as a peer machine in apeer-to-peer (or distributed) network environment.

The machine may comprise a server computer, a client user computer, apersonal computer (PC), a tablet, a smart phone, a laptop computer, adesktop computer, a control system, a network router, switch or bridge,or any machine capable of executing a set of instructions (sequential orotherwise) that specify actions to be taken by that machine. It will beunderstood that a communication device of the subject disclosureincludes broadly any electronic device that provides voice, video ordata communication. Further, while a single machine is illustrated, theterm “machine” shall also be taken to include any collection of machinesthat individually or jointly execute a set (or multiple sets) ofinstructions to perform any one or more of the methods discussed herein.

Computer system 500 may include a processor (or controller) 504 (e.g., acentral processing unit (CPU)), a graphics processing unit (GPU, orboth), a main memory 506 and a static memory 508, which communicate witheach other via a bus 510. The computer system 500 may further include adisplay unit 512 (e.g., a liquid crystal display (LCD), a flat panel, ora solid-state display). Computer system 500 may include an input device514 (e.g., a keyboard), a cursor control device 516 (e.g., a mouse), adisk drive unit 518, a signal generation device 520 (e.g., a speaker orremote control) and a network interface device 522. In distributedenvironments, the embodiments described in the subject disclosure can beadapted to utilize multiple display units 512 controlled by two or morecomputer systems 500. In this configuration, presentations described bythe subject disclosure may in part be shown in a first of display units512, while the remaining portion is presented in a second of displayunits 512.

The disk drive unit 518 may include a tangible computer-readable storagemedium 524 on which is stored one or more sets of instructions (e.g.,software 526) embodying any one or more of the methods or functionsdescribed herein, including those methods illustrated above.Instructions 526 may also reside, completely or at least partially,within main memory 506, static memory 508, or within processor 504during execution thereof by the computer system 500. Main memory 506 andprocessor 504 also may constitute tangible computer-readable storagemedia.

As shown in FIG. 6, telecommunication system 600 may include wirelesstransmit/receive units (WTRUs) 602, a RAN 604, a core network 606, apublic switched telephone network (PSTN) 608, the Internet 610, or othernetworks 612, though it will be appreciated that the disclosed examplescontemplate any number of WTRUs, base stations, networks, or networkelements. Each WTRU 602 may be any type of device configured to operateor communicate in a wireless environment. For example, a WTRU maycomprise drone 102, a mobile device, network device 300, or the like, orany combination thereof. By way of example, WTRUs 602 may be configuredto transmit or receive wireless signals and may include a UE, a mobilestation, a mobile device, a fixed or mobile subscriber unit, a pager, acellular telephone, a PDA, a smartphone, a laptop, a netbook, a personalcomputer, a wireless sensor, consumer electronics, or the like. WTRUs602 may be configured to transmit or receive wireless signals over anair interface 614.

Telecommunication system 600 may also include one or more base stations616. Each of base stations 616 may be any type of device configured towirelessly interface with at least one of the WTRUs 602 to facilitateaccess to one or more communication networks, such as core network 606,PTSN 608, Internet 610, or other networks 612. By way of example, basestations 616 may be a base transceiver station (BTS), a Node-B, an eNodeB, a Home Node B, a Home eNode B, a site controller, an access point(AP), a wireless router, or the like. While base stations 616 are eachdepicted as a single element, it will be appreciated that base stations616 may include any number of interconnected base stations or networkelements.

RAN 604 may include one or more base stations 616, along with othernetwork elements (not shown), such as a base station controller (BSC), aradio network controller (RNC), or relay nodes. One or more basestations 616 may be configured to transmit or receive wireless signalswithin a particular geographic region, which may be referred to as acell (not shown). The cell may further be divided into cell sectors. Forexample, the cell associated with base station 616 may be divided intothree sectors such that base station 616 may include three transceivers:one for each sector of the cell. In another example, base station 616may employ multiple-input multiple-output (MIMO) technology and,therefore, may utilize multiple transceivers for each sector of thecell.

Base stations 616 may communicate with one or more of WTRUs 602 over airinterface 614, which may be any suitable wireless communication link(e.g., RF, microwave, infrared (IR), ultraviolet (UV), or visiblelight). Air interface 614 may be established using any suitable radioaccess technology (RAT).

More specifically, as noted above, telecommunication system 600 may be amultiple access system and may employ one or more channel accessschemes, such as CDMA, TDMA, FDMA, OFDMA, SC-FDMA, or the like. Forexample, base station 616 in RAN 604 and WTRUs 602 connected to RAN 604may implement a radio technology such as Universal MobileTelecommunications System (UMTS) Terrestrial Radio Access (UTRA) thatmay establish air interface 614 using wideband CDMA (WCDMA). WCDMA mayinclude communication protocols, such as High-Speed Packet Access (HSPA)or Evolved HSPA (HSPA+). HSPA may include High-Speed Downlink PacketAccess (HSDPA) or High-Speed Uplink Packet Access (HSUPA).

As another example base station 616 and WTRUs 602 that are connected toRAN 604 may implement a radio technology such as Evolved UMTSTerrestrial Radio Access (E-UTRA), which may establish air interface 614using LTE or LTE-Advanced (LTE-A).

Optionally base station 616 and WTRUs 602 connected to RAN 604 mayimplement radio technologies such as IEEE 602.16 (i.e., WorldwideInteroperability for Microwave Access (WiMAX)), CDMA2000, CDMA2000 1x,CDMA2000 EV-DO, Interim Standard 2000 (IS-2000), Interim Standard 95(IS-95), Interim Standard 856 (IS-856), GSM, Enhanced Data rates for GSMEvolution (EDGE), GSM EDGE (GERAN), or the like.

Base station 616 may be a wireless router, Home Node B, Home eNode B, oraccess point, for example, and may utilize any suitable RAT forfacilitating wireless connectivity in a localized area, such as a placeof business, a home, a vehicle, a campus, or the like. For example, basestation 616 and associated WTRUs 602 may implement a radio technologysuch as IEEE 602.11 to establish a wireless local area network (WLAN).As another example, base station 616 and associated WTRUs 602 mayimplement a radio technology such as IEEE 602.15 to establish a wirelesspersonal area network (WPAN). In yet another example, base station 616and associated WTRUs 602 may utilize a cellular-based RAT (e.g., WCDMA,CDMA2000, GSM, LTE, LTE-A, etc.) to establish a picocell or femtocell.As shown in FIG. 6, base station 616 may have a direct connection toInternet 610. Thus, base station 616 may not be required to accessInternet 610 via core network 606.

RAN 604 may be in communication with core network 606, which may be anytype of network configured to provide voice, data, applications, and/orvoice over internet protocol (VoIP) services to one or more WTRUs 602.For example, core network 606 may provide call control, billingservices, mobile location-based services, pre-paid calling, Internetconnectivity, video distribution or high-level security functions, suchas user authentication. Although not shown in FIG. 6, it will beappreciated that RAN 604 or core network 606 may be in direct orindirect communication with other RANs that employ the same RAT as RAN604 or a different RAT. For example, in addition to being connected toRAN 604, which may be utilizing an E-UTRA radio technology, core network606 may also be in communication with another RAN (not shown) employinga GSM radio technology.

Core network 606 may also serve as a gateway for WTRUs 602 to accessPSTN 608, Internet 610, or other networks 612. PSTN 608 may includecircuit-switched telephone networks that provide plain old telephoneservice (POTS). For LTE core networks, core network 606 may use IMS core614 to provide access to PSTN 608. Internet 610 may include a globalsystem of interconnected computer networks or devices that use commoncommunication protocols, such as the transmission control protocol(TCP), user datagram protocol (UDP), or IP in the TCP/IP interneprotocol suite. Other networks 612 may include wired or wirelesscommunications networks owned or operated by other service providers.For example, other networks 612 may include another core networkconnected to one or more RANs, which may employ the same RAT as RAN 604or a different RAT.

Some or all WTRUs 602 in telecommunication system 600 may includemulti-mode capabilities. That is, WTRUs 602 may include multipletransceivers for communicating with different wireless networks overdifferent wireless links. For example, one or more WTRUs 602 may beconfigured to communicate with base station 616, which may employ acellular-based radio technology, and with base station 616, which mayemploy an IEEE 802 radio technology.

FIG. 7 is an example system 100 including RAN 604 and core network 606.As noted above, RAN 604 may employ an E-UTRA radio technology tocommunicate with WTRUs 602 over air interface 614. RAN 604 may also bein communication with core network 606.

RAN 604 may include any number of eNode-Bs 702 while remainingconsistent with the disclosed technology. One or more eNode-Bs 702 mayinclude one or more transceivers for communicating with the WTRUs 602over air interface 614. Optionally, eNode-Bs 702 may implement MIMOtechnology. Thus, one of eNode-Bs 702, for example, may use multipleantennas to transmit wireless signals to, or receive wireless signalsfrom, one of WTRUs 602.

Each of eNode-Bs 702 may be associated with a particular cell (notshown) and may be configured to handle radio resource managementdecisions, handover decisions, scheduling of users in the uplink ordownlink, or the like. As shown in FIG. 7 eNode-Bs 702 may communicatewith one another over an X2 interface.

Core network 606 shown in FIG. 7 may include a mobility managementgateway or entity (MME) 704, a serving gateway 706, or a packet datanetwork (PDN) gateway 708. While each of the foregoing elements aredepicted as part of core network 606, it will be appreciated that anyone of these elements may be owned or operated by an entity other thanthe core network operator.

MME 704 may be connected to each of eNode-Bs 702 in RAN 604 via an S1interface and may serve as a control node. For example, MME 704 may beresponsible for authenticating users of WTRUs 602, bearer activation ordeactivation, selecting a particular serving gateway during an initialattach of WTRUs 602, or the like. MME 704 may also provide a controlplane function for switching between RAN 604 and other RANs (not shown)that employ other radio technologies, such as GSM or WCDMA.

Serving gateway 706 may be connected to each of eNode-Bs 702 in RAN 604via the Si interface. Serving gateway 706 may generally route or forwarduser data packets to or from the WTRUs 602. Serving gateway 706 may alsoperform other functions, such as anchoring user planes duringinter-eNode B handovers, triggering paging when downlink data isavailable for WTRUs 602, managing or storing contexts of WTRUs 602, orthe like.

Serving gateway 706 may also be connected to PDN gateway 708, which mayprovide WTRUs 602 with access to packet-switched networks, such asInternet 610, to facilitate communications between WTRUs 602 andIP-enabled devices.

Core network 606 may facilitate communications with other networks. Forexample, core network 606 may provide WTRUs 602 with access tocircuit-switched networks, such as PSTN 608, such as through IMS core614, to facilitate communications between WTRUs 602 and traditionalland-line communications devices. In addition, core network 606 mayprovide the WTRUs 602 with access to other networks 612, which mayinclude other wired or wireless networks that are owned or operated byother service providers.

FIG. 8 depicts an overall block diagram of an example packet-basedmobile cellular network environment, such as a GPRS network as describedherein. In the example packet-based mobile cellular network environmentshown in FIG. 8, there are a plurality of base station subsystems (BSS)800 (only one is shown), each of which comprises a base stationcontroller (BSC) 802 serving a plurality of BTSs, such as BTSs 804, 806,808. BTSs 804, 806, 808 are the access points where users ofpacket-based mobile devices become connected to the wireless network. Inexample fashion, the packet traffic originating from mobile devices istransported via an over-the-air interface to BTS 808, and from BTS 808to BSC 802. Base station subsystems, such as BSS 800, are a part ofinternal frame relay network 810 that can include a service GPRS supportnodes (SGSN), such as SGSN 812 or SGSN 814. Each SGSN 812, 814 isconnected to an internal packet network 816 through which SGSN 812, 814can route data packets to or from a plurality of gateway GPRS supportnodes (GGSN) 818, 820, 822. As illustrated, SGSN 814 and GGSNs 818, 820,822 are part of internal packet network 816. GGSNs 818, 820, 822 mainlyprovide an interface to external IP networks such as PLMN 824, corporateintranets/internets 826, or Fixed-End System (FES) or the publicInternet 828. As illustrated, subscriber corporate network 826 may beconnected to GGSN 820 via a firewall 830. PLMN 824 may be connected toGGSN 820 via a boarder gateway router (BGR) 832. A Remote AuthenticationDial-In User Service (RADIUS) server 834 may be used for callerauthentication when a user calls corporate network 826.

Generally, there may be a several cell sizes in a network, referred toas macro, micro, pico, femto or umbrella cells. The coverage area ofeach cell is different in different environments. Macro cells can beregarded as cells in which the base station antenna is installed in amast or a building above average roof top level. Micro cells are cellswhose antenna height is under average roof top level. Micro cells aretypically used in urban areas. Pico cells are small cells having adiameter of a few dozen meters. Pico cells are used mainly indoors.Femto cells have the same size as pico cells, but a smaller transportcapacity. Femto cells are used indoors, in residential or small businessenvironments. On the other hand, umbrella cells are used to covershadowed regions of smaller cells and fill in gaps in coverage betweenthose cells.

FIG. 9 illustrates an architecture of a typical GPRS network 900 asdescribed herein. The architecture depicted in FIG. 9 may be segmentedinto four groups: users 902, RAN 904, core network 906, and interconnectnetwork 908. Users 902 comprise a plurality of end users, who each mayuse one or more devices 910. Note that device 910 is referred to as amobile subscriber (MS) in the description of network shown in FIG. 9. Inan example, device 910 comprises a communications device (e.g., mobiledevice 102, mobile positioning center 116, network device 300, any ofdetected devices 500, second device 508, access device 604, accessdevice 606, access device 608, access device 610 or the like, or anycombination thereof). Radio access network 904 comprises a plurality ofBSSs such as BSS 912, which includes a BTS 914 and a BSC 916. Corenetwork 906 may include a host of various network elements. Asillustrated in FIG. 9, core network 906 may comprise MSC 918, servicecontrol point (SCP) 920, gateway MSC (GMSC) 922, SGSN 924, home locationregister (HLR) 926, authentication center (AuC) 928, domain name system(DNS) server 930, and GGSN 932. Interconnect network 908 may alsocomprise a host of various networks or other network elements. Asillustrated in FIG. 9, interconnect network 908 comprises a PSTN 934, anFES/Internet 936, a firewall 1038, or a corporate network 940.

An MSC can be connected to a large number of BSCs. At MSC 918, forinstance, depending on the type of traffic, the traffic may be separatedin that voice may be sent to PSTN 934 through GMSC 922, or data may besent to SGSN 924, which then sends the data traffic to GGSN 932 forfurther forwarding.

When MSC 918 receives call traffic, for example, from BSC 916, it sendsa query to a database hosted by SCP 920, which processes the request andissues a response to MSC 918 so that it may continue call processing asappropriate.

HLR 926 is a centralized database for users to register to the GPRSnetwork. HLR 926 stores static information about the subscribers such asthe International Mobile Subscriber Identity (IMSI), subscribedservices, or a key for authenticating the subscriber. HLR 926 alsostores dynamic subscriber information such as the current location ofthe MS. Associated with HLR 926 is AuC 928, which is a database thatcontains the algorithms for authenticating subscribers and includes theassociated keys for encryption to safeguard the user input forauthentication.

In the following, depending on context, “mobile subscriber” or “MS”sometimes refers to the end user and sometimes to the actual portabledevice, such as a mobile device, used by an end user of the mobilecellular service. When a mobile subscriber turns on his or her mobiledevice, the mobile device goes through an attach process by which themobile device attaches to an SGSN of the GPRS network. In FIG. 9, whenMS 910 initiates the attach process by turning on the networkcapabilities of the mobile device, an attach request is sent by MS 910to SGSN 924. The SGSN 924 queries another SGSN, to which MS 910 wasattached before, for the identity of MS 910. Upon receiving the identityof MS 910 from the other SGSN, SGSN 924 requests more information fromMS 910. This information is used to authenticate MS 910 together withthe information provided by HLR 926. Once verified, SGSN 924 sends alocation update to HLR 926 indicating the change of location to a newSGSN, in this case SGSN 924. HLR 926 notifies the old SGSN, to which MS910 was attached before, to cancel the location process for MS 910. HLR926 then notifies SGSN 924 that the location update has been performed.At this time, SGSN 924 sends an Attach Accept message to MS 910, whichin turn sends an Attach Complete message to SGSN 924.

Next, MS 910 establishes a user session with the destination network,corporate network 940, by going through a Packet Data Protocol (PDP)activation process. Briefly, in the process, MS 910 requests access tothe Access Point Name (APN), for example, UPS.com, and SGSN 924 receivesthe activation request from MS 910. SGSN 924 then initiates a DNS queryto learn which GGSN 932 has access to the UPS.com APN. The DNS query issent to a DNS server within core network 906, such as DNS server 930,which is provisioned to map to one or more GGSNs in core network 906.Based on the APN, the mapped GGSN 932 can access requested corporatenetwork 940. SGSN 924 then sends to GGSN 932 a Create PDP ContextRequest message that contains necessary information. GGSN 932 sends aCreate PDP Context Response message to SGSN 924, which then sends anActivate PDP Context Accept message to MS 910.

Once activated, data packets of the call made by MS 910 can then gothrough RAN 904, core network 906, and interconnect network 908, in aparticular FES/Internet 936 and firewall 1038, to reach corporatenetwork 940.

FIG. 10 illustrates a PLMN block diagram view of an example architecturethat may be replaced by a telecommunications system. In FIG. 10, solidlines may represent user traffic signals, and dashed lines may representsupport signaling. MS 1002 is the physical equipment used by the PLMNsubscriber. For example, drone 102, network device 300, the like, or anycombination thereof may serve as MS 1002. MS 1002 may be one of, but notlimited to, a cellular telephone, a cellular telephone in combinationwith another electronic device or any other wireless mobilecommunication device.

MS 1002 may communicate wirelessly with BSS 1004. BSS 1004 contains BSC1006 and a BTS 1008. BSS 1004 may include a single BSC 1006/BTS 1008pair (base station) or a system of BSC/BTS pairs that are part of alarger network. BSS 1004 is responsible for communicating with MS 1002and may support one or more cells. BSS 1004 is responsible for handlingcellular traffic and signaling between MS 1002 and a core network 1010.Typically, BSS 1004 performs functions that include, but are not limitedto, digital conversion of speech channels, allocation of channels tomobile devices, paging, or transmission/reception of cellular signals.

Additionally, MS 1002 may communicate wirelessly with RNS 1012. RNS 1012contains a Radio Network Controller (RNC) 1014 and one or more Nodes B1016. RNS 1012 may support one or more cells. RNS 1012 may also includeone or more RNC 1014/Node B 1016 pairs or alternatively a single RNC1014 may manage multiple Nodes B 1016. RNS 1012 is responsible forcommunicating with MS 1002 in its geographically defined area. RNC 1014is responsible for controlling Nodes B 1016 that are connected to it andis a control element in a UMTS radio access network. RNC 1014 performsfunctions such as, but not limited to, load control, packet scheduling,handover control, security functions, or controlling MS 1002 access tocore network 1010.

An E-UTRA Network (E-UTRAN) 1018 is a RAN that provides wireless datacommunications for MS 1002 and UE 1024. E-UTRAN 1018 provides higherdata rates than traditional UMTS. It is part of the LTE upgrade formobile networks, and later releases meet the requirements of theInternational Mobile Telecommunications (IMT) Advanced and are commonlyknown as a 4G networks. E-UTRAN 1018 may include of series of logicalnetwork components such as E-UTRAN Node B (eNB) 1020 and E-UTRAN Node B(eNB) 1022. E-UTRAN 1018 may contain one or more eNBs. User equipment(UE) 1024 may be any mobile device capable of connecting to E-UTRAN 1018including, but not limited to, a personal computer, laptop, mobiledevice, wireless router, or other device capable of wirelessconnectivity to E-UTRAN 1018. The improved performance of the E-UTRAN1018 relative to a typical UMTS network allows for increased bandwidth,spectral efficiency, and functionality including, but not limited to,voice, high-speed applications, large data transfer or IPTV, while stillallowing for full mobility.

Typically, MS 1002 may communicate with any or all of BSS 1004, RNS1012, or E-UTRAN 1018. In an illustrative system, each of BSS 1004, RNS1012, and E-UTRAN 1018 may provide MS 1002 with access to core network1010. Core network 1010 may include of a series of devices that routedata and communications between end users. Core network 1010 may providenetwork service functions to users in the circuit switched (CS) domainor the packet switched (PS) domain. The CS domain refers to connectionsin which dedicated network resources are allocated at the time ofconnection establishment and then released when the connection isterminated. The PS domain refers to communications and data transfersthat make use of autonomous groupings of bits called packets. Eachpacket may be routed, manipulated, processed or handled independently ofall other packets in the PS domain and does not require dedicatednetwork resources.

The circuit-switched MGW function (CS-MGW) 1026 is part of core network1010 and interacts with VLR/MSC server 1028 and GMSC server 1030 inorder to facilitate core network 1010 resource control in the CS domain.Functions of CS-MGW 1026 include, but are not limited to, mediaconversion, bearer control, payload processing or other mobile networkprocessing such as handover or anchoring. CS-MGW 1026 may receiveconnections to MS 1002 through BSS 1004 or RNS 1012.

SGSN 1032 stores subscriber data regarding MS 1002 in order tofacilitate network functionality. SGSN 1032 may store subscriptioninformation such as, but not limited to, the IMSI, temporary identities,or PDP addresses. SGSN 1032 may also store location information such as,but not limited to, GGSN address for each GGSN 1034 where an active PDPexists. GGSN 1034 may implement a location register function to storesubscriber data it receives from SGSN 1032 such as subscription orlocation information.

Serving gateway (S-GW) 1036 is an interface which provides connectivitybetween E-UTRAN 1018 and core network 1010. Functions of S-GW 1036include, but are not limited to, packet routing, packet forwarding,transport level packet processing, or user plane mobility anchoring forinter-network mobility. PCRF 1038 uses information gathered from P-GW1036, as well as other sources, to make applicable policy and chargingdecisions related to data flows, network resources or other networkadministration functions. PDN gateway (PDN-GW) 1040 may provideuser-to-services connectivity functionality including, but not limitedto, GPRS/EPC network anchoring, bearer session anchoring and control, orIP address allocation for PS domain connections.

HSS 1042 is a database for user information and stores subscription dataregarding MS 1002 or UE 1024 for handling calls or data sessions.Networks may contain one HSS 1042 or more if additional resources arerequired. Example data stored by HSS 1042 include, but is not limitedto, user identification, numbering or addressing information, securityinformation, or location information. HSS 1042 may also provide call orsession establishment procedures in both the PS and CS domains.

VLR/MSC Server 1028 provides user location functionality. When MS 1002enters a new network location, it begins a registration procedure. A MSCserver for that location transfers the location information to the VLRfor the area. A VLR and MSC server may be located in the same computingenvironment, as is shown by VLR/MSC server 1028, or alternatively may belocated in separate computing environments. A VLR may contain, but isnot limited to, user information such as the IMSI, the Temporary MobileStation Identity (TMSI), the Local Mobile Station Identity (LMSI), thelast known location of the mobile station, or the SGSN where the mobilestation was previously registered. The MSC server may containinformation such as, but not limited to, procedures for MS 1002registration or procedures for handover of MS 1002 to a differentsection of core network 1010. GMSC server 1030 may serve as a connectionto alternate GMSC servers for other MSs in larger networks.

EIR 1044 is a logical element which may store the IMEI for MS 1002. Userequipment may be classified as either “white listed” or “black listed”depending on its status in the network. If MS 1002 is stolen and put touse by an unauthorized user, it may be registered as “black listed” inEIR 1044, preventing its use on the network. A MME 1046 is a controlnode which may track MS 1002 or UE 1024 if the devices are idle.Additional functionality may include the ability of MME 1046 to contactidle MS 1002 or UE 1024 if retransmission of a previous session isrequired.

As described herein, a telecommunications system wherein management andcontrol utilizing a software designed network (SDN) and a simple IP arebased, at least in part, on user equipment, may provide a wirelessmanagement and control framework that enables common wireless managementand control, such as mobility management, radio resource management,QoS, load balancing, etc., across many wireless technologies, e.g. LTE,Wi-Fi, and future 5G access technologies; decoupling the mobilitycontrol from data planes to let them evolve and scale independently;reducing network state maintained in the network based on user equipmenttypes to reduce network cost and allow massive scale; shortening cycletime and improving network upgradability; flexibility in creatingend-to-end services based on types of user equipment and applications,thus improve customer experience; or improving user equipment powerefficiency and battery life—especially for simple M2M devices—throughenhanced wireless management.

While examples of a telecommunications system have been described inconnection with various computing devices/processors, the underlyingconcepts may be applied to any computing device, processor, or systemcapable of facilitating a telecommunications system. The varioustechniques described herein may be implemented in connection withhardware or software or, where appropriate, with a combination of both.Thus, the methods and devices may take the form of program code (i.e.,instructions) embodied in concrete, tangible, storage media having aconcrete, tangible, physical structure. Examples of tangible storagemedia include floppy diskettes, CD-ROMs, DVDs, hard drives, or any othertangible machine-readable storage medium (computer-readable storagemedium). Thus, a computer-readable storage medium is not a signal. Acomputer-readable storage medium is not a transient signal. Further, acomputer-readable storage medium is not a propagating signal. Acomputer-readable storage medium as described herein is an article ofmanufacture. When the program code is loaded into and executed by amachine, such as a computer, the machine becomes a device fortelecommunications. In the case of program code execution onprogrammable computers, the computing device will generally include aprocessor, a storage medium readable by the processor (includingvolatile or nonvolatile memory or storage elements), at least one inputdevice, and at least one output device. The program(s) can beimplemented in assembly or machine language, if desired. The languagecan be a compiled or interpreted language and may be combined withhardware implementations.

The methods and devices associated with a telecommunications system asdescribed herein also may be practiced via communications embodied inthe form of program code that is transmitted over some transmissionmedium, such as over electrical wiring or cabling, through fiber optics,or via any other form of transmission, wherein, when the program code isreceived and loaded into and executed by a machine, such as an EPROM, agate array, a programmable logic device (PLD), a client computer, or thelike, the machine becomes an device for implementing telecommunicationsas described herein. When implemented on a general-purpose processor,the program code combines with the processor to provide a unique devicethat operates to invoke the functionality of a telecommunicationssystem.

While a telecommunications system has been described in connection withthe various examples of the various figures, it is to be understood thatother similar implementations may be used, or modifications andadditions may be made to the described examples of a telecommunicationssystem without deviating therefrom. For example, one skilled in the artwill recognize that a telecommunications system as described in theinstant application may apply to any environment, whether wired orwireless, and may be applied to any number of such devices connected viaa communications network and interacting across the network. Therefore,a telecommunications system as described herein should not be limited toany single example, but rather should be construed in breadth and scopein accordance with the appended claims.

1. A method comprising: receiving a request to instantiate a networkelement in a network; instantiating the network element in the networkin accordance with the request; configuring a mutable network element tosimulate at least one other network element in the network based on therequest; commanding the mutable network element to test the networkelement prior to the network element becoming operational in thenetwork; and responsive to results of the test, receiving a confirmationthat the network element is configured in accordance with the request.2. (canceled)
 3. The method of claim 1 wherein the test is an off-lineoperational test.
 4. The method of claim 1 wherein the test is based onpolicies.
 5. The method of claim 1 further comprising receiving an alertinstead of the confirmation if the test is a failed test.
 6. The methodof claim 1 further comprising enabling the network element to becomeoperational.
 7. A system comprising: an orchestrator for asoftware-defined network and configured to receive a request foroperation of the software-defined network; a software-defined networkcontroller in communication with the orchestrator through a northboundapplication programming interface; at least one network element incommunication with the software defined network controller though asouthbound application programming interface, the network elementconfigured to instantiate a network element based on the request; and amutable network element configured to receive the request andinstantiate one or more additional virtual functions within the mutablenetwork element in accordance with the request.
 8. The system of claim 7wherein the mutable network element is configured to perform a test onthe at least one network element in accordance with the request.
 9. Thesystem of claim 8 wherein the test is successful, and the mutablenetwork element is configured to communicate the results of the test tothe orchestrator.
 10. The system of claim 9 wherein the at least onenetwork element becomes operational in accordance with the request. 11.The system of claim 8 wherein the test is not successful, and themutable network element is configured to generate an alarm message. 12.The system of claim 7 further comprising a policy database containingone or more policies and wherein the mutable network element isconfigured to test the at least one network element in accordance withthe one or more policies.
 13. The system of claim 7 wherein the mutablenetwork element is further configured to communicate with the at leastone network element.
 14. The system of claim 7 wherein the mutablenetwork element is configured to instantiate a plurality of replicatedvirtual functions to mimic an operation of one or more network elementfunctions.
 15. The system of claim 14 wherein the mutable networkelement is configured to perform a test of the at least one networkelement by interaction with the plurality of replicated virtualfunctions.
 16. The system of claim 14 wherein the test includes testingone of a permissible configuration or an impermissible configuration.17. An apparatus comprising: an input-output interface; a processorcoupled to the input-output interface wherein the processor is furthercoupled to a memory the memory having stored thereon executableinstructions that when executed by the processor cause the processor toeffectuate operations comprising: receiving a request to instantiate anetwork element; creating at least one virtual function to test thenetwork element; testing the network element; and permitting the networkelement to become active based on the testing.
 18. The apparatus ofclaim 16 wherein the testing step is based on one of the request or apolicy.
 19. The apparatus of claim 18 wherein if the testing step is notsuccessful, the operations further comprise generating an alarm insteadof performing the permitting step.
 20. The apparatus of claim 18 whereinthe operations further comprise deleting the virtual function after thepermitting step is executed.